« Phase 10 README

Hitchhiker's Guide — Cedar Lattice Phase 10: Social Engineering Range

Operation Cedar Lattice. This guide walks through the fictional engagement environment for Phase 10. Meridian Freight International is the target. FIN-LATTICE is the emulated actor. Everything in this document is synthetic: the email headers, domains, OSINT data, and employee names are fabricated for educational use. No real infrastructure is involved.

The Meridian Freight Environment

Organizational Profile (Synthetic)

Meridian Freight International is a fictional mid-size logistics company (1,200 employees) headquartered in Atlanta, GA. It operates a freight brokerage platform, a fleet management portal, and an API-driven shipment tracking service. Key facts for the engagement:

• Primary domain: meridianfreight.com
• Microsoft 365 tenant: mail delivered via Exchange Online
• CRM: Salesforce (confirmed via job postings and LinkedIn)
• Cloud: AWS (EKS cluster for tracking API, S3 for document storage)
• IdP: Okta SSO with MFA enforced for VPN and internal SaaS
• EDR: CrowdStrike Falcon deployed to Windows endpoints
• SIEM: Splunk (contract confirmed via job posting for Splunk Admin)
• Email gateway: Mimecast (outbound and inbound filtering)
• DMARC status: p=none — monitoring only, no enforcement

Email Infrastructure

The engagement's OSINT phase discovered the following DNS records for meridianfreight.com:

SPF Record:

meridianfreight.com. 300 IN TXT "v=spf1 include:_spf.google.com include:mailgun.org
    include:spf.protection.outlook.com ip4:198.51.100.14 ~all"

Note: ~all (softfail). The include:mailgun.org entry means any server on Mailgun's sending network passes SPF for meridianfreight.com. Mailgun is a commercial ESP — the SPF record was likely added when Meridian's marketing team set up email campaigns and was never removed. This is a common finding in enterprise SPF records.

DKIM Key Record (selector: mimecast20230101):

mimecast20230101._domainkey.meridianfreight.com. 300 IN TXT (
    "v=DKIM1; k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQ"
    "KBgQDsP7X...rest-of-key...AQAB"
)

DMARC Record:

_dmarc.meridianfreight.com. 300 IN TXT (
    "v=DMARC1; p=none; rua=mailto:dmarc-reports@meridianfreight.com;"
    "fo=1; adkim=r; aspf=r"
)

Critical finding: p=none. Mimecast (the gateway) provides some ML-based phishing detection, but the DMARC layer enforces nothing. A phishing email that passes SPF (using the Mailgun include:) will be delivered even if DKIM is absent and DMARC is technically a failure.

Subdomains (from certificate transparency scan)

The following subdomains were identified for meridianfreight.com:

The vpn. subdomain is the highest-priority target for credential stuffing (post-phish credential harvest). The staging. subdomain may have weaker controls and real data.

OSINT Findings — FIN-LATTICE Phase 10 Reconnaissance

Email Pattern Inference

From public GitHub repositories under the meridian-freight organization account, the following email addresses were observed in git commit metadata:

john.smith@meridianfreight.com       # Senior Software Engineer (freight platform)
a.jones@meridianfreight.com          # DevOps Engineer (EKS cluster work)
jdoe@meridianfreight.com             # IT Admin (Okta/Active Directory)
sarah.williams@meridianfreight.com   # Data Engineer (Splunk dashboards)

Email pattern analysis:

• john.smith and sarah.williams → first.last@meridianfreight.com
• a.jones → f.last@meridianfreight.com (initial + last)
• jdoe → flast@meridianfreight.com (initial + last, no separator)

Dominant pattern: first.last@meridianfreight.com (3 of 4 observed).

With LinkedIn providing 200 employee names, the email pattern yields approximately 200 targetable email addresses. The engagement pre-authorization letter covers a seeded mailbox in the range only — no live employee is targeted.

Job Postings (at time of reconnaissance)

Key postings observed on LinkedIn and Meridian's careers page:

1. Salesforce Administrator — "Manage and optimize our Salesforce CRM platform, including user provisioning, custom object configuration, and integration with our freight operations workflow."

2. AWS Cloud Engineer — "Drive our freight tracking API migration from on-premise to AWS EKS. Experience with IAM, EKS, and S3 required."

3. ServiceNow Developer — "Implement ITSM workflows on ServiceNow to streamline our IT helpdesk operations."

4. CrowdStrike Engineer — "Manage and tune our CrowdStrike Falcon deployment across 1,200 Windows and macOS endpoints."

5. Splunk Administrator — "Manage Splunk indexers and search heads; build detection use cases for our SOC team."

Pretext opportunities derived:

• Salesforce renewal / account team — highest priority (universally trusted, financial context, urgency via "renewal").
• AWS migration specialist — second priority (technical audience but high autonomy).
• ServiceNow professional services — for IT operations staff.

FIN-LATTICE Email Sample (Synthetic, Educational Only)

The following is a synthetic example of a FIN-LATTICE-style pretext email. It is provided to illustrate the analysis in Lab 01. No real phishing email is constructed or sent.

From: Alex Chen <a.chen@salesforce-accountteam.com>
To: john.smith@meridianfreight.com
Reply-To: support@salesforce-renewals.ru
Subject: Meridian Freight — Contract #MF-2024-0891 Renewal (Action Required by Friday)

Hi John,

I'm reaching out regarding your Salesforce Enterprise contract, MF-2024-0891,
which is coming up for renewal this Friday, June 27.

We've prepared a revised pricing proposal that includes the new Einstein Copilot
add-on your VP of Sales requested last quarter. The proposal also corrects the
overage charges from Q4 that your finance team flagged.

Please review and approve the attached proposal or log into the renewal portal
at: https://salesforce-contract-portal.meridianfreight-renewal.com/review

If you have questions, reply to this email or call me at +1 (415) 555-0198.

Best,
Alex Chen
Account Executive, Salesforce Enterprise
alex.chen@salesforce.com (primary) | a.chen@salesforce-accountteam.com

Analysis of this synthetic email:

The sending domain salesforce-accountteam.com is an attacker-registered lookalike. It likely passes SPF (the attacker controls the SPF record for this domain). DKIM may or may not be present (if absent, DMARC reports failure but p=none delivers anyway). The Reply-To header points to salesforce-renewals.ru — a different base domain entirely. This is the reply-to mismatch signal (Lab 01 +3 risk score).

Header fields that Lab 01's analyzer would see:

{
    "from_domain": "meridianfreight.com",       # the claimed domain (display)
    "spf_result": "pass",                        # attacker's domain has valid SPF
    "dkim_result": "fail",                       # no DKIM or invalid signature
    "dkim_domain": "",                           # no DKIM d= tag
    "dmarc_policy": "none",                      # target's DMARC is unenforced
    "dmarc_result": "fail",                      # would fail alignment even if SPF passes
    "reply_to_domain": "salesforce-renewals.ru", # reply-to mismatch
}

Lab 01 risk score calculation:

• SPF pass (0) — the attacker's server is authorized by their domain's SPF.
• DKIM fail (+3).
• DMARC none (+2).
• Reply-to mismatch: salesforce-renewals.ru base = salesforce-renewals.ru ≠ meridianfreight.com → +3.
• Total: 8 → HIGH.

Note: The from_domain in the lab header dict represents the domain being analyzed (the domain shown in the From: header), not the attacker's sending domain. The SPF result reflects whether the sending server was authorized by the sending domain. In the above scenario the attacker controls their sending domain so SPF passes — but the reply-to mismatch and DKIM failure still produce HIGH risk.

Phase 10 Artifact — Cedar Lattice Engagement Note

OPERATION CEDAR LATTICE
Phase 10 — Initial Access: Social Engineering
Target: Meridian Freight International
Emulated Actor: FIN-LATTICE

KEY FINDINGS (Phase 10 reconnaissance):

1. DMARC p=none on meridianfreight.com
   Impact: Any email claiming to be from meridianfreight.com is delivered regardless of
   SPF/DKIM result. No enforcement. rua= reports go to dmarc-reports@meridianfreight.com
   — unclear if they are parsed or actioned.
   Recommendation (defensive): Move to p=quarantine after auditing rua= reports for 30
   days. Expected legitimate senders: Exchange Online, Mailgun (marketing), Mimecast.

2. Permissive SPF: include:mailgun.org with ~all
   Impact: Any server on Mailgun's sending network passes SPF for meridianfreight.com.
   Combined with p=none, this means an attacker who uses Mailgun (or any server within
   mailgun.org's SPF includes) can send mail that passes SPF and is delivered.
   Recommendation: Audit whether Mailgun is still in use; remove if not. Tighten to -all.

3. VPN endpoint at vpn.meridianfreight.com
   Impact: Cisco AnyConnect VPN is externally accessible. Post-phish credential harvest
   targeting VPN is high-probability pivot path.
   Recommendation: Verify MFA enforcement on VPN; restrict to known source IPs where
   operationally feasible.

4. staging.meridianfreight.com accessible externally
   Impact: Staging environments frequently contain production data clones with weaker
   authentication controls. Requires further investigation.
   Recommendation: Restrict staging to internal IP ranges or require VPN.

5. Email pattern: first.last@meridianfreight.com
   Impact: With LinkedIn providing ~200 employee names, the pattern yields a targetable
   address book with high confidence.
   Recommendation: Implement email gateway controls that detect bulk delivery to pattern-
   inferred addresses (unusual for external senders).

PHASE 10 CONCLUSION:
The combination of DMARC p=none + permissive SPF + identifiable email pattern + Salesforce/
AWS pretext opportunities represents a high-probability initial-access path. FIN-LATTICE's
documented playbook maps directly to this environment. Recommend immediate DMARC enforcement
and SPF tightening as the two highest-ROI defensive actions before any other phase-10
remediation.

« Phase 10 README | Lab 01 — Email Auth Analyzer | Lab 02 — OSINT Surface Mapper